Quote:

---

The EFF's case against AT&T has barely begun, yet it has already brought to light some fascinating details about the methods behind the NSA's alleged wiretapping abilities. Mark Klein, a retired AT&T engineer who is now participating in the case as a witness, has released a statement to the media in which he outlines many of the allegations that are currently under seal. Chief among them is his claim that AT&T installed powerful traffic monitoring equipment in a "secret room" in their San Francisco switching office at the behest of the NSA.

"In 2002, when I was working in an AT&T office in San Francisco, the site manager told me to expect a visit from a National Security Agency agent, who was to interview a management-level technician for a special job. The agent came, and by chance I met him and directed him to the appropriate people. In January 2003, I, along with others, toured the AT&T central office on Folsom Street in San Francisco—actually three floors of an SBC building. There I saw a new room being built adjacent to the 4ESS switch room where the public's phone calls are routed. I learned that the person whom the NSA interviewed for the secret job was the person working to install equipment in this room. The regular technician work force was not allowed in the room."

According to Klein, this room contained (among other things) a Narus STA 6400 traffic analyzer into which all of AT&T's Internet and phone traffic was routed; Klein himself helped wire the splitter box that made this possible. In addition to AT&T's own traffic, Klein alleges that the company also routed its peering links into the splitter, meaning that any traffic that passed through AT&T's own network could be scanned. Futhermore, San Francisco wasn't the only place such secret rooms were built; Klein claims that AT&T offices in Seattle, San Jose, Los Angeles, and San Diego also have them.

---

Quote:

---

A careless mistake by Microsoft programmers has shown that special access codes for use by the U.S. National Security Agency (NSA) have been secretly built into all versions of the Windows operating system. ... The driver, called ADVAPI.DLL, enables and controls a range of security functions including the Microsoft Cryptographic API (MS-CAPI). ... Now, a North Carolina security company has come up with conclusive evidence the second key belongs to the NSA. Like van Someren, Andrew Fernandes, chief scientist with Cryptonym of Morrisville, North Carolina, had been probing the presence and significance of the two keys. Then he checked the latest Service Pack release for Windows NT4, Service Pack 5. He found Microsoft's developers had failed to remove or "strip" the debugging symbols used to test this software before they released it. Inside the code were the labels for the two keys. One was called "KEY." The other was called "NSAKEY."Fernandes reported his re-discovery of the two CAPI keys, and their secret meaning, to the "Advances in Cryptology, Crypto'99" conference held in Santa Barbara. According to those present at the conference, Windows developers attending the conference did not deny the "NSA" key was built into their software. But they refused to talk about what the key did, or why it had been put there without users' knowledge. But according to two witnesses attending the conference, even Microsoft's top crypto programmers were stunned to learn that the version of ADVAPI.DLL shipping with Windows 2000 contains not two, but three keys. Brian LaMachia, head of CAPI development at Microsoft was "stunned" to learn of these discoveries by outsiders. This discovery, by van Someren, was based on advance search methods which test and report on the "entropy" of programming code.

---